1. Field of the Invention
Embodiments of the present invention generally relate to message communication across a network. More particularly, the present invention relates to a method and apparatus for creating predictive filters for messages using a reputation database of message features.
2. Description of the Related Art
People communicate with each other in numerous ways. For example, one person may send a message (e.g., email, text message, multi-media message, and the like) across a network (e.g., Internet) to a recipient. An email, generally, has a sender address, a recipient address, a header, a body, in addition to other sections. Before the email reaches the recipient, it is processed by a mail server. The mail server may comprise a filter that is keyed to particular features of a message. If certain features (e.g., a domain name, a name server, a country of origin, a host IP address, and the like) are present that are known to indicate sources of messages containing unwanted or harmful contact, then the email is filtered and/or prevented from reaching the recipient. Otherwise, the email is relayed to the recipient.
The presence of certain features of the message may indicate that the message is potentially hazardous to hardware, software, and/or data (e.g., SPAM, phish, malware, a virus, a Trojan, a worm, a denial of service attack and/or is an otherwise unwanted message). SPAM is a commercial message, such as an email, presenting a user with an advertisement. Phish is a process of fraudulently obtaining a person's passwords under the pretense of a legitimate message from a reputable company. Malware, viruses, Trojans, worms, and denial of service attacks are examples of potentially hazardous programs embedded in emails and executed on a computer of the recipient.
Filters help protect the hardware, software, and data of the recipient from damage. Filters are data structures that contain information on features of common unwanted messages, which are used by software programs to prevent the transmission of those unwanted messages. For example, filters may be created for domains known for sending SPAM, phish, and other unwanted messages. Filters are also created for domains known to be included in SPAM emails. In either case, filters are created for a domain only after an email is already sent to the recipient and determined to be SPAM. Consequently, damage may occur prior to a filter being created for unwanted messages.
Therefore, there is a need for a method and apparatus for creating message filters for domains before unwanted messages are sent to a recipient.